DMARC record generator

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks, and where to send reports about it. It is the main defence against attackers sending phishing emails that spoof your domain, and it is required by Gmail and Yahoo for bulk senders.

How to use it

1. Choose the policy: none, quarantine or reject.
2. Add an email address for aggregate reports (rua).
3. Set optional values such as alignment mode and percentage.
4. Publish the TXT record at _dmarc.yourdomain.com.

Example

Name: _dmarc.example.com
Value: v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100; adkim=s; aspf=s

Tags explained

• p: policy for failing mail. none only monitors, quarantine sends to spam, reject blocks.
• rua: where daily aggregate XML reports are sent.
• pct: percentage of failing mail the policy applies to, useful for gradual rollout.
• adkim / aspf: alignment, r relaxed (subdomains match) or s strict.
• sp: policy for subdomains.

Safe rollout plan

1. Start with p=none and collect reports for 2 to 4 weeks.
2. Identify every legitimate sender (newsletter tools, CRM, helpdesk) and fix their SPF and DKIM.
3. Move to p=quarantine, possibly with a low pct.
4. Finish with p=reject.

Jumping straight to reject can block your own invoices and marketing emails.